Technical Information
Malicious functions
Terminates or attempts to terminate
the following user processes:
- firefox.exe
Searches for windows to
detect analytical utilities:
- ClassName: 'OLLYDBG', WindowName: ''
- ClassName: 'GBDYLLO', WindowName: ''
- ClassName: 'pediy06', WindowName: ''
- ClassName: 'FilemonClass', WindowName: ''
- ClassName: '', WindowName: 'File Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'PROCMON_WINDOW_CLASS', WindowName: ''
- ClassName: '', WindowName: 'Process Monitor - Sysinternals: www.sysinternals.com'
- ClassName: 'RegmonClass', WindowName: ''
- ClassName: '', WindowName: 'Registry Monitor - Sysinternals: www.sysinternals.com'
Modifies file system
Creates the following files
- %ProgramFiles(x86)%\mozilla firefox\zlib1.dll
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\datareporting
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\minidumps
- %APPDATA%\mozilla\firefox\profiles\gn7ryp3k.default\crashes
- %WINDIR%\installer\{c8113ef1-b806-4b96-b566-2fe13c912c64}\{b0f53186-bd02-4266-ba37-962eabdd0bef}.xpi
- %ProgramFiles(x86)%\google\chrome\application\version.dll
- %WINDIR%\installer\{c2890c6c-07a2-4ac4-a1e8-909b8772b1d7}\chnbnbbpfmblidkbeejhkgiabmdpgblborx
- %WINDIR%\installer\{c2890c6c-07a2-4ac4-a1e8-909b8772b1d7}\xhnbnbbpfmblidkbeejhkgiabmdpgblboml
- %WINDIR%\syswow64\grouppolicy\gpt.ini
- %TEMP%\9f0.tmp.bat
- nul
Substitutes the following files
- %APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default\user.js
- %APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default\secmod.db
- %APPDATA%\Mozilla\Firefox\Profiles\gn7ryp3k.default\healthreport.sqlite
- %PROGRAMDATA%\ntuser.pol
Deletes itself.
Network activity
UDP
- DNS ASK up.##pixel.com
- DNS ASK no##js.org
- DNS ASK my###ejs.net
- DNS ASK la.##nodejs.net
Miscellaneous
Searches for the following windows
- ClassName: '18467-41' WindowName: ''
Creates and executes the following
- '%WINDIR%\syswow64\sc.exe' config MozillaMaintenance start= disabled' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop MozillaMaintenance' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' config gupdate start= disabled' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop gupdate' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' config gupdatem start= disabled' (with hidden window)
- '%WINDIR%\syswow64\sc.exe' stop gupdatem' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\9F0.tmp.bat" > NUL' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\sc.exe' config MozillaMaintenance start= disabled
- '%WINDIR%\syswow64\sc.exe' stop MozillaMaintenance
- '%WINDIR%\syswow64\sc.exe' config gupdate start= disabled
- '%WINDIR%\syswow64\sc.exe' stop gupdate
- '%WINDIR%\syswow64\sc.exe' config gupdatem start= disabled
- '%WINDIR%\syswow64\sc.exe' stop gupdatem
- '<SYSTEM32>\raserver.exe' /offerraupdate
- '%WINDIR%\syswow64\cmd.exe' /c "%TEMP%\9F0.tmp.bat" > NUL
- '%WINDIR%\syswow64\ping.exe' 127.0.0.1 -n 2 -w 1000